wednesdayai 0.5.1-dev.21 → 0.5.1-dev.23

package/dist/{gateway-cli-CzrTOBz5.js → gateway-cli-rJFjYA1c.js}

@@ -4,7 +4,7 @@ import { t as isPlainObject } from "./plain-object-CLm2c5Nu.js";
 import { m as defaultRuntime, n as runtimeForLogger, o as setConsoleSubsystemFilter, s as setConsoleTimestampPrefix, t as createSubsystemLogger } from "./subsystem-CnWdoPKw.js";
 import "./boolean-C71HJEcH.js";
 import { i as logAcceptedEnvOption, r as isTruthyEnvValue } from "./entry.js";
-import { a as cancelDelayedAgentTurnWaiters, c as enqueueAgentTurn, i as agentTurnIdempotencyKey, l as isClaimableAgentTurnWorkId, m as WORKSPACE_LANE_DENIED_REASON, r as AGENT_TURN_TOPIC, s as createRecoveryAgentTurnStager } from "./agent-turn-enqueue-DK8QApSV.js";
+import { a as cancelDelayedAgentTurnWaiters, c as enqueueAgentTurn, i as agentTurnIdempotencyKey, l as isClaimableAgentTurnWorkId, m as WORKSPACE_LANE_DENIED_REASON, r as AGENT_TURN_TOPIC, s as createRecoveryAgentTurnStager } from "./agent-turn-enqueue-CI-A0Cuo.js";
 import { $ as AVATAR_MAX_BYTES, $a as orderGatewaySpaMountsForStages, A as coerceIdentityValue, Ai as GATEWAY_CLIENT_MODES, Bo as resolveHooksGmailModel, Ci as isWebchatClient, Cn as registerInternalHook, Co as buildAllowedModelSet, Do as getModelRefStatus, Fn as loadSessionStore, Fr as buildChannelAccountBindings, Go as resolveThinkingDefault, I as parseByteSize, Io as resolveAllowedModelRef, Ja as ensureControlUiAllowedOriginsForNonLoopbackBind, Ka as applyMergePatch, Kt as getActivePluginRegistryVersion, Li as cleanStaleLockFiles, Mi as hasGatewayClientCap, Mo as normalizeModelSelection, Nn as getConfiguredSessionStorageRuntime, Nt as CHANNEL_IDS, Oc as loadAuthProfileStoreForRuntime, Oi as GATEWAY_CLIENT_CAPS, On as SessionStorageUnavailableError, Pi as normalizeGatewayClientMode, Po as normalizeProviderIdForAuth, Qa as isGatewayControlUiV2Enabled, Rc as resolveAuthProfileDisplayLabel, Ro as resolveConfiguredModelRef, Sn as createInternalHookEvent, So as resolveSubagentMaxConcurrent, Ss as getApiKeyForModel, Ti as normalizeMessageChannel, Tn as StorageReadAccessError, Ts as resolveApiKeyForProvider, Uc as normalizeSecretInput, Un as updateSessionStore, Us as resolveProfileUnusableUntilForDisplay, Wt as getActivePluginRegistry, Xa as DEFAULT_GATEWAY_CONTROL_UI_V2_BASE_PATH, Ya as DEFAULT_GATEWAY_CONTROL_UI_BASE_PATH, Yn as setSessionRuntimeModel, Yr as normalizeWhatsAppTarget, Za as DEFAULT_GATEWAY_WEB_CLIENT_BASE_PATH, Zr as resolveWhatsAppAccount, Zt as setGatewayPluginRegistry, _i as INTERNAL_MESSAGE_CHANNEL, _n as getRegisteredRealtimeTranscriptionProviders, _o as resolveTalkConversationConfig, a as createConfigIO, bi as isGatewayMessageChannel, bn as listRealtimeVoiceProviders, bo as resolveAgentMaxConcurrent, br as normalizeChannelId, c as loadConfig, cr as resolveSessionFilePath, d as readConfigFileSnapshotForWrite, ea as setPluginTaskAdmissionRejectionFor, el as DEFAULT_CONTEXT_TOKENS, en as createEmptyPluginRegistry, eo as resolveGatewayConsoleBasePath, er as parseDurationMs, f as resolveConfigSnapshotHash, fi as deliveryContextFromSession, fo as DEFAULT_TALK_CONVERSATION_MODEL_ID, fr as resolveSessionTranscriptsDirForAgent, g as OpenClawSchema, gi as normalizeSessionDeliveryFields, gn as getRealtimeVoiceProvider, go as resolveTalkCatalogApiKeyStatus, h as validateConfigObjectWithPlugins, ho as resolveActiveTalkProviderConfig, j as EXEC_POLICY_PRESET_IDS, ji as GATEWAY_CLIENT_NAMES, ka as resolveExecutablePath, ki as GATEWAY_CLIENT_IDS, kn as requireSessionStorageRuntime, ko as isCliProvider, l as parseConfigJson5, ln as emitStartupPluginHealthReport, lr as resolveSessionFilePathOptions, m as writeConfigFile, mi as mergeDeliveryContext, mo as normalizeTalkSection, n as migrateLegacyConfig, na as RecoveryAdmissionError, nl as DEFAULT_PROVIDER, nn as getRegisteredPluginApis, no as resolveGatewayControlUiV2BasePath, nt as isAvatarImageDataUrl, o as getRuntimeConfigSnapshot, on as setSessionWorkAvailableNotifier, ot as looksLikeAvatarPath, po as buildTalkConfigResponse, pr as resolveStorePath, qa as applyLegacyMigrations, qn as mergeSessionEntry, r as advanceRuntimeConfigSnapshot, ra as composeRestartDeferralWithAdmission, ro as resolveGatewayWebClientBasePath, s as getRuntimeConfigSourceSnapshot, tl as DEFAULT_MODEL, to as resolveGatewayControlUiBasePath, tt as isAvatarHttpUrl, u as readConfigFileSnapshot, ur as resolveSessionTranscriptPath, vi as isDeliverableMessageChannel, vn as getRegisteredRealtimeVoiceProviders, vo as resolveTalkProviderConfigApiKey, vr as getChannelPlugin, vt as isTestDefaultMemorySlotDisabled, wn as triggerInternalHook, wt as defaultSlotIdForKey, xn as clearInternalHooks, xo as resolveNestedAgentMaxConcurrent, yi as isGatewayCliClient, yn as getRegisteredStreamingSpeechProviders, yr as listChannelPlugins, zo as resolveDefaultModelForAgent } from "./config-CYZVnAj4.js";
 import { r as resolveRuntimeServiceVersion, t as VERSION } from "./version-D_9__Xw6.js";
 import { B as isSubagentSessionKey, D as toDeviceSenderId, E as toAgentStoreSessionKey, L as isCronRunSessionKey, O as DEFAULT_ACCOUNT_ID, T as toAgentRequestSessionKey, V as parseAgentSessionKey, _ as resolveAgentIdFromSessionKey, a as buildAgentMainSessionKey, b as resolveDeviceIdentity, g as resolveAgentIdFromQualifiedSessionKey, k as normalizeAccountId$1, m as normalizeMainKey, p as normalizeAgentId, s as classifySessionKeyShape, t as DEFAULT_AGENT_ID, x as resolveLinkedPeerIdForChannel, y as resolveConfiguredCanonicalIdentity } from "./session-key-CwCMr1YE.js";
@@ -19,16 +19,16 @@ import { o as handleStaticAppHttpRequest } from "./static-app-DcH1RI1W.js";
 import { c as optionalStringEnum, l as stringEnum } from "./retry-policy-FBwX2QEP.js";
 import "./send-DOZvL0Oc.js";
 import "./send-DIJpnY93.js";
-import { $ as setDispatchInboundAdmissionRejectionFor, $n as resolveAgentTimeoutMs, $t as discoverAllSessions, A as createPluginRuntime, Ar as WorkspaceLaneDeniedError, B as agentCommandFromIngress, Bn as normalizeMimeList, Bt as buildSafeExternalPrompt, Cr as setTtsEnabled, Ct as resetDirectoryCache, D as getLoadedAnalysisConcurrency, Dr as OPENAI_TTS_VOICES, Dt as consumeRestartSentinel, E as clearPluginRegistryCaches, Er as OPENAI_TTS_MODELS, F as handleSlackHttpRequest, Fn as DEFAULT_INPUT_IMAGE_MIMES, Ft as normalizeCronJobPatch, G as createOutboundSendDeps$1, Gt as persistBrowserProxyFiles, H as resolveAgentOutboundTarget, Ht as getHookType, I as readJsonBodyWithLimit, In as DEFAULT_INPUT_MAX_REDIRECTS, It as migrateLegacyCronPayload, Jn as listDescendantRunsForRequester, K as resolveAgentAvatar, Kn as countActiveDescendantRuns, Kt as resolveSessionAuthProfileOverride, L as requestBodyErrorToText, Ln as DEFAULT_INPUT_TIMEOUT_MS, Lt as buildDeliveryFromLegacyPayload, Mn as ACP_SESSION_IDENTITY_RENDERER_VERSION, Mr as resolveWorkspaceLaneConfig, N as resolveAgentOutboundIdentity, Nn as isAcpEnabledByPolicy, Nt as writeRestartSentinel, O as loadOpenClawPlugins, Or as DEFAULT_HEARTBEAT_ACK_MAX_CHARS, Ot as formatDoctorNonInteractiveHint, Pn as DEFAULT_INPUT_IMAGE_MAX_BYTES, Pt as normalizeCronJobCreate, Q as dispatchInboundMessage, Qn as readLatestAssistantReply, Rn as extractFileContentFromSource, Rt as hasLegacyDeliveryHints, S as buildDefaultToolPolicyPipelineSteps, Sr as resolveTtsProviderOrder, T as resolvePluginTools, Tn as isSystemEventContextChanged, Tr as textToSpeech, Tt as runWithModelFallback, U as createOutboundSendDeps, Un as resolveSendPolicy, Ut as isExternalHookSession, V as resolveAgentDeliveryPlan, Vn as resolveInputFileLimits, Vt as detectSuspiciousPatterns, W as createDefaultDeps, Wn as isAbortRequestText, Wt as applyBrowserProxyPaths, X as buildHistoryContextFromEntries, Xn as runSubagentAnnounceFlow, Zn as resolveAnnounceTargetFromKey, _ as snapshotRunPendingWrites, _r as isTtsProviderConfigured, _t as resolveOutboundSessionRoute, a as runHeartbeatOnce, an as deferGatewayRestartUntilIdle, ar as stripLeadingStamps, b as resolveExecConfig, br as resolveTtsConfig, bt as resolveSessionDeliveryTarget, c as startHeartbeatRunner, cn as markGatewaySigusr1RestartHandled, d as getLastHeartbeatEvent, dn as setPreRestartDeferralCheck, dt as getCliSessionId, en as loadCostUsageSummary, er as getSessionBindingService, et as createReplyDispatcher, f as onHeartbeatEvent, fn as triggerOpenClawRestart, fr as setTaskPipelineStatus, ft as setCliSessionId, g as runEmbeddedPiAgent, gr as isTtsEnabled, gt as ensureOutboundSessionEntry, h as resolveCronSession, hn as loadProviderUsageSummary, hr as getTtsProvider, i as resolveHeartbeatSummaryForAgent, in as consumeGatewaySigusr1RestartAuthorization, ir as parseLeadingStamps, it as formatWorkspaceLaneDeniedNotice, j as requestNudge, jr as checkWorkspaceLaneAdmission, jt as summarizeRestartSentinel, k as takePendingActivationMigration, kn as requestHeartbeatNow, kr as stripHeartbeatToken, kt as formatRestartSentinelMessage, l as runWakeGate, ln as scheduleGatewaySigusr1Restart, lt as resolveChannelAccountEnabled, m as isCronSystemEvent, mr as resolveUserTimezone, mt as createOpenClawTools, n as runMainAgentTurn, nn as loadSessionLogs, nr as getExistingFollowupQueue, nt as notifyInterruptedRuns, on as emitGatewayRestart, or as stripLeadingStampsFlush, p as redactSensitiveHeartbeatEvent, pr as DEFAULT_MAX_PARALLEL, pt as runCliAgent, qn as initSubagentRegistry, r as resolveHeartbeatConfig, rn as loadSessionUsageTimeSeries, rr as removeQueuedFollowupRun, rt as buildWorkspaceLaneActor, s as setHeartbeatsEnabled, sn as isGatewaySigusr1RestartExternallyAllowed, sr as ToolInputError, tn as loadSessionCostSummary, tr as clearSessionQueues, tt as getTotalPendingReplies, u as resolveHeartbeatVisibility, un as setGatewaySigusr1RestartPolicy, ur as resolveSessionLane, ut as BARE_SESSION_RESET_PROMPT, v as waitForPendingWrites, vr as resolveTtsApiKey, vt as resolveHeartbeatDeliveryTarget, w as getPluginToolMeta, wn as enqueueSystemEvent, wr as setTtsProvider, x as applyToolPolicyPipeline, xr as resolveTtsPrefsPath, xt as resolveOutboundChannelPlugin, yr as resolveTtsAutoMode, yt as resolveOutboundTarget, zn as extractImageContentFromSource, zt as stripLegacyDeliveryFields } from "./agent-turn-execute-3cc3W1hp.js";
+import { $ as setDispatchInboundAdmissionRejectionFor, $n as resolveAgentTimeoutMs, $t as discoverAllSessions, A as createPluginRuntime, Ar as WorkspaceLaneDeniedError, B as agentCommandFromIngress, Bn as normalizeMimeList, Bt as buildSafeExternalPrompt, Cr as setTtsEnabled, Ct as resetDirectoryCache, D as getLoadedAnalysisConcurrency, Dr as OPENAI_TTS_VOICES, Dt as consumeRestartSentinel, E as clearPluginRegistryCaches, Er as OPENAI_TTS_MODELS, F as handleSlackHttpRequest, Fn as DEFAULT_INPUT_IMAGE_MIMES, Ft as normalizeCronJobPatch, G as createOutboundSendDeps$1, Gt as persistBrowserProxyFiles, H as resolveAgentOutboundTarget, Ht as getHookType, I as readJsonBodyWithLimit, In as DEFAULT_INPUT_MAX_REDIRECTS, It as migrateLegacyCronPayload, Jn as listDescendantRunsForRequester, K as resolveAgentAvatar, Kn as countActiveDescendantRuns, Kt as resolveSessionAuthProfileOverride, L as requestBodyErrorToText, Ln as DEFAULT_INPUT_TIMEOUT_MS, Lt as buildDeliveryFromLegacyPayload, Mn as ACP_SESSION_IDENTITY_RENDERER_VERSION, Mr as resolveWorkspaceLaneConfig, N as resolveAgentOutboundIdentity, Nn as isAcpEnabledByPolicy, Nt as writeRestartSentinel, O as loadOpenClawPlugins, Or as DEFAULT_HEARTBEAT_ACK_MAX_CHARS, Ot as formatDoctorNonInteractiveHint, Pn as DEFAULT_INPUT_IMAGE_MAX_BYTES, Pt as normalizeCronJobCreate, Q as dispatchInboundMessage, Qn as readLatestAssistantReply, Rn as extractFileContentFromSource, Rt as hasLegacyDeliveryHints, S as buildDefaultToolPolicyPipelineSteps, Sr as resolveTtsProviderOrder, T as resolvePluginTools, Tn as isSystemEventContextChanged, Tr as textToSpeech, Tt as runWithModelFallback, U as createOutboundSendDeps, Un as resolveSendPolicy, Ut as isExternalHookSession, V as resolveAgentDeliveryPlan, Vn as resolveInputFileLimits, Vt as detectSuspiciousPatterns, W as createDefaultDeps, Wn as isAbortRequestText, Wt as applyBrowserProxyPaths, X as buildHistoryContextFromEntries, Xn as runSubagentAnnounceFlow, Zn as resolveAnnounceTargetFromKey, _ as snapshotRunPendingWrites, _r as isTtsProviderConfigured, _t as resolveOutboundSessionRoute, a as runHeartbeatOnce, an as deferGatewayRestartUntilIdle, ar as stripLeadingStamps, b as resolveExecConfig, br as resolveTtsConfig, bt as resolveSessionDeliveryTarget, c as startHeartbeatRunner, cn as markGatewaySigusr1RestartHandled, d as getLastHeartbeatEvent, dn as setPreRestartDeferralCheck, dt as getCliSessionId, en as loadCostUsageSummary, er as getSessionBindingService, et as createReplyDispatcher, f as onHeartbeatEvent, fn as triggerOpenClawRestart, fr as setTaskPipelineStatus, ft as setCliSessionId, g as runEmbeddedPiAgent, gr as isTtsEnabled, gt as ensureOutboundSessionEntry, h as resolveCronSession, hn as loadProviderUsageSummary, hr as getTtsProvider, i as resolveHeartbeatSummaryForAgent, in as consumeGatewaySigusr1RestartAuthorization, ir as parseLeadingStamps, it as formatWorkspaceLaneDeniedNotice, j as requestNudge, jr as checkWorkspaceLaneAdmission, jt as summarizeRestartSentinel, k as takePendingActivationMigration, kn as requestHeartbeatNow, kr as stripHeartbeatToken, kt as formatRestartSentinelMessage, l as runWakeGate, ln as scheduleGatewaySigusr1Restart, lt as resolveChannelAccountEnabled, m as isCronSystemEvent, mr as resolveUserTimezone, mt as createOpenClawTools, n as runMainAgentTurn, nn as loadSessionLogs, nr as getExistingFollowupQueue, nt as notifyInterruptedRuns, on as emitGatewayRestart, or as stripLeadingStampsFlush, p as redactSensitiveHeartbeatEvent, pr as DEFAULT_MAX_PARALLEL, pt as runCliAgent, qn as initSubagentRegistry, r as resolveHeartbeatConfig, rn as loadSessionUsageTimeSeries, rr as removeQueuedFollowupRun, rt as buildWorkspaceLaneActor, s as setHeartbeatsEnabled, sn as isGatewaySigusr1RestartExternallyAllowed, sr as ToolInputError, tn as loadSessionCostSummary, tr as clearSessionQueues, tt as getTotalPendingReplies, u as resolveHeartbeatVisibility, un as setGatewaySigusr1RestartPolicy, ur as resolveSessionLane, ut as BARE_SESSION_RESET_PROMPT, v as waitForPendingWrites, vr as resolveTtsApiKey, vt as resolveHeartbeatDeliveryTarget, w as getPluginToolMeta, wn as enqueueSystemEvent, wr as setTtsProvider, x as applyToolPolicyPipeline, xr as resolveTtsPrefsPath, xt as resolveOutboundChannelPlugin, yr as resolveTtsAutoMode, yt as resolveOutboundTarget, zn as extractImageContentFromSource, zt as stripLegacyDeliveryFields } from "./agent-turn-execute-CFwfJKy2.js";
 import { t as redactIdentifier } from "./redact-identifier-C-ydvJ0n.js";
 import { t as CommandLane } from "./lanes-B8kgyKQ9.js";
 import { n as isDiagnosticsEnabled, r as onDiagnosticEvent, t as emitDiagnosticEvent } from "./diagnostic-events-CTBWzSB8.js";
-import { A as redactArtifactLogId, C as accountSessionArtifactsAtTerminalSweep, D as markClientRemovedAcknowledged, E as listSessionArtifacts, F as verificationEnvelopeFingerprint, M as VERIFICATION_CONFIG_SCENARIO, N as buildVerificationEnvelope, O as markRemoved, P as redactVerificationProjection, S as RETAINED_ARTIFACT_KIND, T as isArtifactRegistrationError, _ as isBootIdentityError, a as setAgentTurnRuntime, b as getGatewayRestartRecoveryRuntime, d as isSoakError, f as readTrustedBuildInfo, g as deriveBootIdentityPair, h as armBarrier, i as getAgentTurnRuntime, j as registerBeforeCreate, k as markRetained, l as buildSoakDeploymentRecord, m as acceptSuccessorExecution, n as createAgentTurnRuntimeFromStorage, o as tryGetAgentTurnRuntime, p as verificationSinkReceiptArtifactId, r as getActiveAgentTurnCount, u as evaluateSoak, v as requireProcessBootIdentityPair, w as artifactTokenFor } from "./agent-turn-runner-DUKUxZcn.js";
+import { A as redactArtifactLogId, C as accountSessionArtifactsAtTerminalSweep, D as markClientRemovedAcknowledged, E as listSessionArtifacts, F as verificationEnvelopeFingerprint, M as VERIFICATION_CONFIG_SCENARIO, N as buildVerificationEnvelope, O as markRemoved, P as redactVerificationProjection, S as RETAINED_ARTIFACT_KIND, T as isArtifactRegistrationError, _ as isBootIdentityError, a as setAgentTurnRuntime, b as getGatewayRestartRecoveryRuntime, d as isSoakError, f as readTrustedBuildInfo, g as deriveBootIdentityPair, h as armBarrier, i as getAgentTurnRuntime, j as registerBeforeCreate, k as markRetained, l as buildSoakDeploymentRecord, m as acceptSuccessorExecution, n as createAgentTurnRuntimeFromStorage, o as tryGetAgentTurnRuntime, p as verificationSinkReceiptArtifactId, r as getActiveAgentTurnCount, u as evaluateSoak, v as requireProcessBootIdentityPair, w as artifactTokenFor } from "./agent-turn-runner-12Exv9CB.js";
 import { a as resolveSessionRunStore, t as createSessionRunRecorder } from "./recorder-Ch6dEacF.js";
 import { i as clientResumeRecordArtifactId, o as isVerificationStoreError, t as CLIENT_RESUME_RECORD_KIND } from "./verification-store-6R8__-w7.js";
 import { t as getGatewayInstanceId } from "./gateway-instance-id-D5aje4G5.js";
-import "./pi-embedded-helpers-D7uD-CgK.js";
-import { C as resolveToolProfilePolicy, _ as collectExplicitAllowlist, y as mergeAlsoAllowPolicy } from "./sandbox-Cf0p0qcn.js";
+import "./pi-embedded-helpers-Brv2iTWi.js";
+import { C as resolveToolProfilePolicy, _ as collectExplicitAllowlist, y as mergeAlsoAllowPolicy } from "./sandbox-CEDb7iCz.js";
 import { i as listCoreToolSections, n as PROFILE_OPTIONS, o as resolveCoreToolProfiles } from "./tool-catalog-BWgva5h1.js";
 import { i as resolveRelayAuthTokenForPort, n as resolveGatewayRelayToken } from "./extension-relay-auth-B3ZMdHUj.js";
 import { i as enableTailscaleServe, n as disableTailscaleServe, o as getTailnetHostname, r as enableTailscaleFunnel, t as disableTailscaleFunnel } from "./tailscale-DFHS2SJQ.js";
@@ -36,11 +36,11 @@ import { t as safeEqualSecret } from "./secret-equal-CQn9WoXt.js";
 import { n as pickPrimaryTailnetIPv4, r as pickPrimaryTailnetIPv6 } from "./tailnet-CQ2rXtjH.js";
 import { c as normalizeHostHeader, d as resolveGatewayBindHost, f as resolveGatewayListenHosts, i as isLoopbackHost, l as pickPrimaryLanIPv4, n as isLocalishHost, o as isTrustedProxyAddress, r as isLoopbackAddress, s as isValidIPv4, t as rawDataToString, u as resolveClientIp } from "./ws-QU171jAr.js";
 import { a as isDirectLoopbackProvenance, c as AUTH_RATE_LIMIT_SCOPE_BROWSER_EXTENSION, d as AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET, f as createAuthRateLimiter, i as captureTransportProvenance, l as AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN, n as authorizeHttpGatewayConnect, o as isLocalDirectRequest, p as normalizeRateLimitClientIp, r as authorizeWsControlUiGatewayConnect, s as resolveGatewayAuth, t as assertGatewayAuthConfigured, u as AUTH_RATE_LIMIT_SCOPE_HOOK_AUTH } from "./auth-DZtg7WnJ.js";
-import { o as ensureGatewayStartupAuth, s as mergeGatewayTailscaleConfig } from "./server-context-BIoSfzI_.js";
+import { o as ensureGatewayStartupAuth, s as mergeGatewayTailscaleConfig } from "./server-context-Dv15RG_H.js";
 import { d as hasBinary } from "./frontmatter-Ddt-po4I.js";
 import { i as loadWorkspaceSkillEntries, r as buildWorkspaceSkillSnapshot } from "./skills-BBjj0xDl.js";
 import { n as assertNoPathAliasEscape } from "./path-alias-guards-5b1JZAG8.js";
-import { a as testRegexWithBoundedInput, i as compileSafeRegex } from "./redact-ptfKNzIm.js";
+import { a as testRegexWithBoundedInput, i as compileSafeRegex, n as redactSensitiveText } from "./redact-ptfKNzIm.js";
 import { i as formatErrorMessage, o as hasErrnoCode, r as formatErrorChainMessage, s as isErrno } from "./errors-WJSmX0uj.js";
 import { i as openFileWithinRoot, l as writeFileWithinRoot, s as readLocalFileSafely, t as SafeOpenError } from "./fs-safe-Bi6IMuVy.js";
 import { n as SsrFBlockedError } from "./proxy-env-B4Vr2jcU.js";
@@ -53,7 +53,7 @@ import { t as resolveNetworkSsrFPolicy } from "./ssrf-config-C60x4trY.js";
 import "./server-middleware-DSz240GW.js";
 import { n as readJsonFile, r as writeJsonAtomic, t as createAsyncLock } from "./json-files-BG94WsMo.js";
 import { B as PASS_METRICS_MAX_BYTES, H as isPassIdentifier, R as PASS_ITEMS_MAX_KEYS, U as onRunInvalidation, X as decodeKeysetCursor, Z as encodeKeysetCursor, on as formatMessageStamp, r as resolveSessionStorageConfig, vn as deriveSessionTotalTokens, yn as hasNonzeroUsage, z as PASS_MEASUREMENT_SCHEMA_VERSION } from "./storage-config-BnKikkky.js";
-import { $ as resolveExplicitAgentSessionKey, J as stripInlineDirectiveTagsForDisplay, Q as resolveAgentMainSessionKey, S as runGlobalGatewayStopSafely, Y as stripInlineDirectiveTagsFromMessageForDisplay, Z as canonicalizeMainSessionAlias, et as resolveMainSessionKey, n as parseSessionThreadInfo, o as hydrateAndAppendToBackend, t as extractDeliveryInfo, tt as resolveMainSessionKeyFromConfig, v as getGlobalHookRunner, x as resetGlobalHookRunner, y as getGlobalPluginRegistry } from "./sessions-9SvxsXWP.js";
+import { $ as resolveExplicitAgentSessionKey, J as stripInlineDirectiveTagsForDisplay, Q as resolveAgentMainSessionKey, S as runGlobalGatewayStopSafely, Y as stripInlineDirectiveTagsFromMessageForDisplay, Z as canonicalizeMainSessionAlias, et as resolveMainSessionKey, n as parseSessionThreadInfo, o as hydrateAndAppendToBackend, t as extractDeliveryInfo, tt as resolveMainSessionKeyFromConfig, v as getGlobalHookRunner, x as resetGlobalHookRunner, y as getGlobalPluginRegistry } from "./sessions-CLcDtAGY.js";
 import "./reset-DQ2JzmWg.js";
 import { i as parseAbsoluteTimeMs, r as resolveDefaultCronStaggerMs, t as normalizeCronStaggerMs } from "./stagger-CZw92BPF.js";
 import { a as findJobOrThrow, c as recomputeNextRuns, d as resolveJobPayloadTextForMain, g as normalizeHttpWebhookUrl, h as produceCronAgentTurn, i as cronShapeSupportsIdentity, l as recomputeNextRunsForMaintenance, m as normalizeOptionalText, n as computeJobNextRunAtMs, o as isJobDue, p as inferLegacyName, r as createJob, s as nextWakeAtMs, t as applyJobPatch, u as recordScheduleComputeError } from "./jobs-4w_Y24Ex.js";
@@ -62,11 +62,11 @@ import { i as normalizeInputProvenance } from "./input-provenance-C3qizvjt.js";
 import { d as supportsXHighThinking, l as normalizeVerboseLevel, s as normalizeThinkLevel } from "./thinking-CUU7cEHZ.js";
 import { a as resolveAgentIdentity, t as createReplyPrefixOptions } from "./reply-prefix-CKdILE_z.js";
 import { i as isSilentReplyText, n as SILENT_REPLY_TOKEN } from "./tokens-B7jZdHAi.js";
-import { a as getMachineDisplayName, i as startBrowserControlServiceFromConfig, n as createBrowserRouteDispatcher, r as createBrowserControlContext } from "./with-timeout-i0aj653V.js";
-import { A as setActiveRunProbe, M as stopDiagnosticHeartbeat, j as startDiagnosticHeartbeat, k as resolveStuckSessionWarnMs, t as clearActiveRunProbe } from "./diagnostic-BP20aK6Y.js";
+import { a as getMachineDisplayName, i as startBrowserControlServiceFromConfig, n as createBrowserRouteDispatcher, r as createBrowserControlContext } from "./with-timeout-CkVVKMZ5.js";
+import { A as setActiveRunProbe, M as stopDiagnosticHeartbeat, j as startDiagnosticHeartbeat, k as resolveStuckSessionWarnMs, t as clearActiveRunProbe } from "./diagnostic-CWdhJ9KR.js";
 import { u as snapshotActiveRuns } from "./diagnostic-session-state-BWb5dYUV.js";
-import { _ as waitForActiveTasks, g as setGatewayDrainState, h as setCommandLaneConcurrency, m as resetAllLanes, n as CommandLaneClearedError, o as enqueueCommandInLane, p as markGatewayDraining, r as GatewayDrainingError, s as getActiveTaskCount, u as getTotalQueueSize } from "./command-queue-uNIrlK4C.js";
-import { F as loadCronStore, I as resolveCronStorePath, L as saveCronStore, S as collectTelegramDuplicatePollerDiagnostics } from "./send-DRJrureq.js";
+import { _ as waitForActiveTasks, g as setGatewayDrainState, h as setCommandLaneConcurrency, m as resetAllLanes, n as CommandLaneClearedError, o as enqueueCommandInLane, p as markGatewayDraining, r as GatewayDrainingError, s as getActiveTaskCount, u as getTotalQueueSize } from "./command-queue-BiT79iw_.js";
+import { F as loadCronStore, I as resolveCronStorePath, L as saveCronStore, S as collectTelegramDuplicatePollerDiagnostics } from "./send-Ch1ruPj9.js";
 import { n as resolveModel } from "./model-DbV-8cpI.js";
 import "./pi-model-discovery-BzyXtXC2.js";
 import "./models-config-D6587vYs.js";
@@ -75,11 +75,11 @@ import "./exec-safe-bin-runtime-policy-CP5VVc5d.js";
 import "./session-consumer-agents-DLc0XZRK.js";
 import { n as loadModelCatalog } from "./model-catalog-Cy9yTWf0.js";
 import { t as extractTextFromChatContent } from "./chat-content-w_xCQKkh.js";
-import "./pi-embedded-utils-CR3tST8r.js";
+import "./pi-embedded-utils-D7vaAoE6.js";
 import { r as resolveToolDisplay } from "./tool-display-DIs56-Kd.js";
-import "./provider-image-CAWS0JMV.js";
+import "./provider-image-KmAZWQje.js";
 import "./fetch-xiSjZf28.js";
-import { D as registerUnhandledRejectionHandler, _ as getProviderDeclaredEnvVars, c as transcribeBufferedPcmWithMediaUnderstanding, f as resolveModelEntries, n as buildProviderRegistry, u as resolveCapabilityConfig, v as listAutoDetectableProviders, y as normalizeMediaProviderId } from "./audio-transcription-runner-C_DRSo6Z.js";
+import { D as registerUnhandledRejectionHandler, _ as getProviderDeclaredEnvVars, c as transcribeBufferedPcmWithMediaUnderstanding, f as resolveModelEntries, n as buildProviderRegistry, u as resolveCapabilityConfig, v as listAutoDetectableProviders, y as normalizeMediaProviderId } from "./audio-transcription-runner-BnmmtXUh.js";
 import { t as fetchWithSsrFGuard } from "./fetch-guard-B1X_xQ8y.js";
 import "./proxy-fetch-2addhwrK.js";
 import "./api-key-rotation-BfWwz59P.js";
@@ -92,14 +92,14 @@ import { r as isRestartEnabled } from "./commands-BmKj1gMO.js";
 import "./commands-registry-DK4PgYX-.js";
 import "./user-run-recording-Boh3vvyb.js";
 import { t as withTimeout } from "./with-timeout-B-EduhgJ.js";
-import { a as resolveAgentSessionDirs, t as getAcpSessionManager } from "./manager-d_jLZwIa.js";
-import { $ as validateGlanceWidgetsListParams, $n as rotateDeviceToken, $t as validateSkillsUpdateParams, A as validateConfigSetParams, An as validateWizardStatusParams, At as validateSessionsMaintenanceRunParams, B as validateDeviceIdentityUnlinkParams, Bn as normalizeDeviceMetadataForAuth, C as validateChatSurfacesGetParams, Cn as validateUpdateRunParams, D as validateConfigGetParams, Dn as validateWizardCancelParams, E as validateConfigApplyParams, En as validateWebLoginWaitParams, F as validateCronRunParams, Fn as errorShape, G as validateDeviceTokenRevokeParams, Gn as ensureDeviceToken, Gt as validateSessionsStorageStatusParams, H as validateDevicePairListParams, Hn as approveBootstrapDevicePairing, Ht as validateSessionsSteerParams, I as validateCronRunsParams, J as validateExecApprovalResolveParams, Jn as listDevicePairing, Jt as validateSessionsTitlePrepareParams, K as validateDeviceTokenRotateParams, Kn as getPairedDevice, Kt as validateSessionsStorageValidateParams, L as validateCronStatusParams, M as validateCronAddParams, Mn as RUNS_INVALIDATED_EVENT, N as validateCronListParams, O as validateConfigPatchParams, On as validateWizardNextParams, P as validateCronRemoveParams, Pn as ErrorCodes, Q as validateExecApprovalsSetParams, Qn as revokeDeviceToken, Qt as validateSkillsStatusParams, R as validateCronUpdateParams, Rn as buildDeviceAuthPayload, S as validateChatSendParams, Sn as validateTtsSpeakParams, T as validateChatSurfacesPinParams, Tn as validateWebLoginStartParams, U as validateDevicePairRejectParams, Un as approveDevicePairing, Ut as validateSessionsStorageBackupParams, V as validateDevicePairApproveParams, W as validateDevicePairRemoveParams, Wn as consumeDeviceBootstrapToken, Wt as validateSessionsStorageImportParams, X as validateExecApprovalsNodeGetParams, Xn as removePairedDevice, Xt as validateSkillsBinsParams, Y as validateExecApprovalsGetParams, Yn as rejectDevicePairing, Yt as validateSessionsUsageParams, Z as validateExecApprovalsNodeSetParams, Zn as requestDevicePairing, Zt as validateSkillsInstallParams, _ as validateChannelsStatusParams, _n as validateTasksRunsEventsParams, _t as validateRequestFrame, a as validateAgentIdentityParams, an as validateTalkRealtimeMarkParams, at as validateNodeEventParams, b as validateChatHistoryParams, bn as validateToolsCatalogParams, bt as validateSendParams, c as validateAgentWaitParams, cn as validateTalkRealtimeStopParams, ct as validateNodeListParams, d as validateAgentsFilesGetParams, dn as validateTalkSessionBargeInParams, dt as validateNodePairRejectParams, en as validateTalkCatalogParams, er as summarizeDeviceTokens, et as validateLogsTailParams, f as validateAgentsFilesListParams, fn as validateTalkSessionCancelTurnParams, fr as normalizeDevicePublicKeyBase64Url, ft as validateNodePairRequestParams, g as validateChannelsLogoutParams, gn as validateTasksRunEventsParams, gt as validatePushTestParams, h as validateAgentsUpdateParams, hn as validateTalkSessionMarkParams, ht as validatePollParams, i as formatValidationErrors, in as validateTalkRealtimeBargeInParams, it as validateNodeDescribeParams, j as validateConnectParams, jn as PROTOCOL_VERSION, k as validateConfigSchemaParams, kn as validateWizardStartParams, l as validateAgentsCreateParams, ln as validateTalkRealtimeToolResultParams, lt as validateNodePairApproveParams, m as validateAgentsListParams, mn as validateTalkSessionCreateParams, mt as validateNodeRenameParams, nn as validateTalkModeParams, nr as verifyDeviceBootstrapToken, nt as validateModelsAuthStatusParams, o as validateAgentNudgeParams, on as validateTalkRealtimeSessionParams, or as operatorScopeSatisfied, ot as validateNodeInvokeParams, p as validateAgentsFilesSetParams, pn as validateTalkSessionCloseParams, pr as verifyDeviceSignature, pt as validateNodePairVerifyParams, q as validateExecApprovalRequestParams, rn as validateTalkRealtimeAudioParams, rr as verifyDeviceToken, rt as validateModelsListParams, s as validateAgentParams, sn as validateTalkRealtimeStatusParams, sr as roleScopesAllow, st as validateNodeInvokeResultParams, tn as validateTalkConfigParams, tr as updatePairedDeviceMetadata, tt as validateMemoryIndexParams, u as validateAgentsDeleteParams, un as validateTalkSessionAppendAudioParams, ur as deriveDeviceIdFromPublicKey, ut as validateNodePairListParams, v as validateChatAbortParams, vn as validateTasksRunsGetParams, vt as validateSecretsResolveParams, w as validateChatSurfacesListParams, wn as validateWakeParams, x as validateChatInjectParams, xn as validateTtsReadAloudStatusParams, xt as validateSessionsAbortParams, y as validateChatActivityEvent, yn as validateTasksRunsListParams, yt as validateSecretsResolveResult, z as validateDeviceIdentityLinkParams, zn as buildDeviceAuthPayloadV3 } from "./client-BCYzc-y7.js";
-import { _ as hasNarrowSessionScope, d as APPROVALS_SCOPE, f as PAIRING_SCOPE, g as authorizeOperatorScopesForMethod, h as WRITE_SCOPE, m as SESSION_READ_SCOPE, n as callGateway, p as READ_SCOPE, u as ADMIN_SCOPE$1, v as isHealthProbeAllowedForScopes, x as loadGatewayTlsRuntime$1, y as isNodeRoleMethod } from "./call-xB0MOQUF.js";
+import { a as resolveAgentSessionDirs, t as getAcpSessionManager } from "./manager-gw84UdyQ.js";
+import { $ as validateGlanceWidgetsListParams, $n as revokeDeviceToken, $t as validateSkillsStatusParams, A as validateConfigSetParams, An as validateWizardStartParams, B as validateDeviceIdentityUnlinkParams, Bn as buildDeviceAuthPayloadV3, C as validateChatSurfacesGetParams, Cn as validateTtsSpeakParams, D as validateConfigGetParams, Dn as validateWebLoginWaitParams, E as validateConfigApplyParams, En as validateWebLoginStartParams, F as validateCronRunParams, Fn as ErrorCodes, G as validateDeviceTokenRevokeParams, Gn as consumeDeviceBootstrapToken, Gt as validateSessionsStorageImportParams, H as validateDevicePairListParams, I as validateCronRunsParams, In as errorShape, J as validateExecApprovalResolveParams, K as validateDeviceTokenRotateParams, Kn as ensureDeviceToken, Kt as validateSessionsStorageStatusParams, L as validateCronStatusParams, M as validateCronAddParams, Mn as PROTOCOL_VERSION, N as validateCronListParams, Nn as RUNS_INVALIDATED_EVENT, O as validateConfigPatchParams, On as validateWizardCancelParams, P as validateCronRemoveParams, Q as validateExecApprovalsSetParams, Qn as requestDevicePairing, Qt as validateSkillsInstallParams, R as validateCronUpdateParams, S as validateChatSendParams, Sn as validateTtsReadAloudStatusParams, T as validateChatSurfacesPinParams, Tn as validateWakeParams, U as validateDevicePairRejectParams, Un as approveBootstrapDevicePairing, Ut as validateSessionsSteerParams, V as validateDevicePairApproveParams, Vn as normalizeDeviceMetadataForAuth, W as validateDevicePairRemoveParams, Wn as approveDevicePairing, Wt as validateSessionsStorageBackupParams, X as validateExecApprovalsNodeGetParams, Xn as rejectDevicePairing, Xt as validateSessionsUsageParams, Y as validateExecApprovalsGetParams, Yn as listDevicePairing, Yt as validateSessionsTitlePrepareParams, Z as validateExecApprovalsNodeSetParams, Zn as removePairedDevice, Zt as validateSkillsBinsParams, _ as validateChannelsStatusParams, _n as validateTasksRunEventsParams, _t as validateRequestFrame, a as validateAgentIdentityParams, an as validateTalkRealtimeBargeInParams, at as validateNodeEventParams, b as validateChatHistoryParams, bn as validateTasksRunsListParams, bt as validateSendParams, c as validateAgentWaitParams, cn as validateTalkRealtimeStatusParams, cr as roleScopesAllow, ct as validateNodeListParams, d as validateAgentsFilesGetParams, dn as validateTalkSessionAppendAudioParams, dr as deriveDeviceIdFromPublicKey, dt as validateNodePairRejectParams, en as validateSkillsUpdateParams, er as rotateDeviceToken, et as validateLogsTailParams, f as validateAgentsFilesListParams, fn as validateTalkSessionBargeInParams, ft as validateNodePairRequestParams, g as validateChannelsLogoutParams, gn as validateTalkSessionMarkParams, gt as validatePushTestParams, h as validateAgentsUpdateParams, hn as validateTalkSessionCreateParams, ht as validatePollParams, i as formatValidationErrors, in as validateTalkRealtimeAudioParams, ir as verifyDeviceToken, it as validateNodeDescribeParams, j as validateConnectParams, jn as validateWizardStatusParams, jt as validateSessionsMaintenanceRunParams, k as validateConfigSchemaParams, kn as validateWizardNextParams, l as validateAgentsCreateParams, ln as validateTalkRealtimeStopParams, lt as validateNodePairApproveParams, m as validateAgentsListParams, mn as validateTalkSessionCloseParams, mr as verifyDeviceSignature, mt as validateNodeRenameParams, nn as validateTalkConfigParams, nr as updatePairedDeviceMetadata, nt as validateModelsAuthStatusParams, o as validateAgentNudgeParams, on as validateTalkRealtimeMarkParams, ot as validateNodeInvokeParams, p as validateAgentsFilesSetParams, pn as validateTalkSessionCancelTurnParams, pr as normalizeDevicePublicKeyBase64Url, pt as validateNodePairVerifyParams, q as validateExecApprovalRequestParams, qn as getPairedDevice, qt as validateSessionsStorageValidateParams, rn as validateTalkModeParams, rr as verifyDeviceBootstrapToken, rt as validateModelsListParams, s as validateAgentParams, sn as validateTalkRealtimeSessionParams, sr as operatorScopeSatisfied, st as validateNodeInvokeResultParams, tn as validateTalkCatalogParams, tr as summarizeDeviceTokens, tt as validateMemoryIndexParams, u as validateAgentsDeleteParams, un as validateTalkRealtimeToolResultParams, ut as validateNodePairListParams, v as validateChatAbortParams, vn as validateTasksRunsEventsParams, vt as validateSecretsResolveParams, w as validateChatSurfacesListParams, wn as validateUpdateRunParams, x as validateChatInjectParams, xn as validateToolsCatalogParams, xt as validateSessionsAbortParams, y as validateChatActivityEvent, yn as validateTasksRunsGetParams, yt as validateSecretsResolveResult, z as validateDeviceIdentityLinkParams, zn as buildDeviceAuthPayload } from "./client-MNdGt1bC.js";
+import { _ as hasNarrowSessionScope, d as APPROVALS_SCOPE, f as PAIRING_SCOPE, g as authorizeOperatorScopesForMethod, h as WRITE_SCOPE, m as SESSION_READ_SCOPE, n as callGateway, p as READ_SCOPE, u as ADMIN_SCOPE$1, v as isHealthProbeAllowedForScopes, x as loadGatewayTlsRuntime$1, y as isNodeRoleMethod } from "./call-B1surxJJ.js";
 import "./pairing-token-Cavm9UVj.js";
-import { D as onAgentEvent, E as getAgentRunContext, O as registerAgentRunContext, T as emitAgentEvent, a as getActiveEmbeddedRunCount, c as isEmbeddedPiRunInFlight, d as isInFlightVoiceAttempt, f as peekActiveEmbeddedRun, g as waitForEmbeddedPiRunEnd, l as isEmbeddedPiRunSteerable, o as getActiveEmbeddedRunOwner, r as clearActiveEmbeddedRun, s as isEmbeddedPiRunActive, t as abortEmbeddedPiRun, w as clearAgentRunContext } from "./runs-CoWBHyeo.js";
-import { u as buildOutboundSessionContext } from "./outbound-message-hooks-DD51nZnK.js";
-import { o as normalizeReplyPayloadsForDelivery, s as stampReplyActivity, t as deliverOutboundPayloads } from "./deliver-Lga2gynK.js";
-import { C as computeBackoff, c as pruneLegacyStoreKeys, d as resolveSessionStoreKey, f as capArrayByJsonBytes, g as jsonUtf8Bytes, h as stripEnvelopeFromMessages, l as resolveGatewaySessionStoreTarget, m as stripEnvelopeFromMessage, o as loadCombinedSessionStoreForGateway, r as listAgentsForGateway, s as loadSessionEntry, t as canonicalizeSpawnedByForAgent, u as resolveSessionModelRef, w as sleepWithAbort, x as lookupContextTokens } from "./session-utils-BeYzkx__.js";
+import { D as onAgentEvent, E as getAgentRunContext, O as registerAgentRunContext, T as emitAgentEvent, a as getActiveEmbeddedRunCount, c as isEmbeddedPiRunInFlight, d as isInFlightVoiceAttempt, f as peekActiveEmbeddedRun, g as waitForEmbeddedPiRunEnd, l as isEmbeddedPiRunSteerable, o as getActiveEmbeddedRunOwner, r as clearActiveEmbeddedRun, s as isEmbeddedPiRunActive, t as abortEmbeddedPiRun, w as clearAgentRunContext } from "./runs-BUywHXga.js";
+import { u as buildOutboundSessionContext } from "./outbound-message-hooks-8LGAoYF_.js";
+import { o as normalizeReplyPayloadsForDelivery, s as stampReplyActivity, t as deliverOutboundPayloads } from "./deliver-Czj8jts5.js";
+import { C as computeBackoff, c as pruneLegacyStoreKeys, d as resolveSessionStoreKey, f as capArrayByJsonBytes, g as jsonUtf8Bytes, h as stripEnvelopeFromMessages, l as resolveGatewaySessionStoreTarget, m as stripEnvelopeFromMessage, o as loadCombinedSessionStoreForGateway, r as listAgentsForGateway, s as loadSessionEntry, t as canonicalizeSpawnedByForAgent, u as resolveSessionModelRef, w as sleepWithAbort, x as lookupContextTokens } from "./session-utils-Be7zx7oZ.js";
 import "./fetch-CBvC2P1H.js";
 import { a as readChannelAllowFromStoreSync } from "./pairing-store-b9V8ZMta.js";
 import { a as maxAsk, c as normalizeExecApprovals, g as saveExecApprovalsV2, h as saveExecApprovals, i as loadExecApprovalsV2, l as readExecApprovalsSnapshot, m as resolveExecApprovalsReadOnly, o as mergeExecApprovalsSocketDefaults, r as ensureExecApprovals, s as minSecurity, t as DEFAULT_EXEC_APPROVAL_TIMEOUT_MS } from "./exec-approvals-CEur0PSv.js";
@@ -112,9 +112,9 @@ import { a as buildBaseHints, i as applySensitiveHints, n as redactConfigSnapsho
 import { i as normalizePollInput, t as getChannelActivity } from "./channel-activity-DEcsei6c.js";
 import "./tables-C8SlkvzP.js";
 import "./strip-inbound-meta-BxWVWmTB.js";
-import "./server-lifecycle-fJG-u89x.js";
-import { d as resolveGroupToolPolicy, f as resolveSubagentToolPolicy, u as resolveEffectiveToolPolicy } from "./dm-policy-shared-C8iB_a-f.js";
-import "./reply-directives-GcBlocvi.js";
+import "./server-lifecycle-BIH58Hoe.js";
+import { d as resolveGroupToolPolicy, f as resolveSubagentToolPolicy, u as resolveEffectiveToolPolicy } from "./dm-policy-shared-JZebmiY8.js";
+import "./reply-directives-tE0PyBK-.js";
 import { n as resolveMessageChannelSelection } from "./channel-selection-CWsawadC.js";
 import { i as applyPluginAutoEnable, n as collectUnsafeTelegramPollingTimeouts, s as buildChannelUiCatalog } from "./polling-timeout-D4EU1fEv.js";
 import "./send-0xQ9wUjB.js";
@@ -123,17 +123,17 @@ import "./delivery-queue-DDXSn_Zt.js";
 import "./send-RtcvkwZM.js";
 import "./resolve-route-BCZZ9DsQ.js";
 import "./proxy-DKbAw7kS.js";
-import "./replies-CHagfAgN.js";
+import "./replies-DrGGa5se.js";
 import { n as GATEWAY_AUTH_SURFACE_PATHS, p as isKnownSecretTargetId, r as evaluateGatewayAuthSurfaceStates } from "./runtime-config-collectors-DNphc8a2.js";
-import "./command-secret-targets-DAtwJ6C7.js";
-import { C as normalizeControlUiBasePath, S as buildControlUiAvatarUrl, c as handleReset, w as resolveAssistantAvatarUrl, x as CONTROL_UI_AVATAR_PREFIX } from "./onboard-helpers-BjlBFVLF.js";
+import "./command-secret-targets-9z88Sdd9.js";
+import { C as normalizeControlUiBasePath, S as buildControlUiAvatarUrl, c as handleReset, w as resolveAssistantAvatarUrl, x as CONTROL_UI_AVATAR_PREFIX } from "./onboard-helpers-DFWV67fv.js";
 import "./prompt-style-CKVDypgj.js";
 import "./pairing-labels-DulqhWoV.js";
 import "./session-meta-C-qAwle5.js";
-import { i as resolveMemoryBackendConfig, r as getMemorySearchManager } from "./memory-cli-Dm4vpHAU.js";
+import { i as resolveMemoryBackendConfig, r as getMemorySearchManager } from "./memory-cli-H4nCh_8v.js";
 import { r as resolveMemorySearchConfig } from "./manager-wxBLlf_Z.js";
 import "./query-expansion-BY4TWwDz.js";
-import { a as acquireGatewayLock, i as GatewayLockError, l as backupSqliteSessionDatabase, p as resolveGatewayBackupPath } from "./session-storage-owner-1-cQlOCZ.js";
+import { a as acquireGatewayLock, i as GatewayLockError, l as backupSqliteSessionDatabase, p as resolveGatewayBackupPath } from "./session-storage-owner-M7vbUIWw.js";
 import { t as formatDocsLink } from "./links-CjsJxQbE.js";
 import { n as runCommandWithRuntime } from "./cli-utils-BlFG2Sa_.js";
 import { t as formatHelpExamples } from "./help-format-C4p3t9S-.js";
@@ -146,7 +146,7 @@ import { n as DEFAULT_GATEWAY_HTTP_TOOL_DENY } from "./dangerous-tools-BH3jDch1.
 import { n as inheritOptionFromParent } from "./command-options-CnHA4TzR.js";
 import { t as WizardCancelledError } from "./prompts-Dbym51bP.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-fSLI0qW-.js";
-import { a as pruneAgentConfig, i as loadAgentIdentity, r as findAgentEntryIndex, t as applyAgentConfig } from "./agents.config-BcBusEWj.js";
+import { a as pruneAgentConfig, i as loadAgentIdentity, r as findAgentEntryIndex, t as applyAgentConfig } from "./agents.config-DwW88u5f.js";
 import { t as isWithinDir } from "./path-safety-C0IDvwvF.js";
 import "./install-safe-path-DGX9DaT8.js";
 import "./npm-pack-install-ElGaysfu.js";
@@ -155,7 +155,7 @@ import "./installs-pmfaD2Rz.js";
 import { n as formatConfigIssueLines } from "./issue-format-BL-YSXpb.js";
 import { t as buildChannelAccountSnapshot } from "./status-DNLnVQZ4.js";
 import "./channels-status-issues-KrDarjm0.js";
-import { a as dropDeviceIdentity, i as resolveGatewayClientProfile, l as unlinkDeviceIdentity, o as linkDeviceIdentity, t as WEB_CLIENT_ALLOWED_ORIGINS_CONFIG_KEY } from "./client-profiles-BaJqyqVb.js";
+import { a as dropDeviceIdentity, i as resolveGatewayClientProfile, l as unlinkDeviceIdentity, o as linkDeviceIdentity, t as WEB_CLIENT_ALLOWED_ORIGINS_CONFIG_KEY } from "./client-profiles-BkQpgWwd.js";
 import "./daemon-install-helpers-WjP_W9Qq.js";
 import "./runtime-guard-CP92hiQ7.js";
 import "./service-Dt2JOO0j.js";
@@ -163,38 +163,38 @@ import "./systemd-B7o334kG.js";
 import "./lifecycle-core-Bpt7LPCU.js";
 import "./systemd-hints-k8WLw-5X.js";
 import { t as parsePort$1 } from "./parse-port-DBpsbxHm.js";
-import { n as addGatewayServiceCommands } from "./daemon-cli-sdDY3Rkr.js";
+import { n as addGatewayServiceCommands } from "./daemon-cli-D-zUFs16.js";
 import "./diagnostics-CEDbk97G.js";
 import "./table-B-KRJqXx.js";
 import { n as resolveWideAreaDiscoveryDomain, r as writeWideAreaGatewayZone } from "./widearea-dns-BIBwmnUI.js";
 import { i as toOptionString, n as extractGatewayMiskeys, r as maybeExplainGatewayServiceStop } from "./shared-DbwqyGBL.js";
-import { a as probeGateway, n as collectEnabledInsecureOrDangerousFlags } from "./audit-CmZAI3_9.js";
+import { a as probeGateway, n as collectEnabledInsecureOrDangerousFlags } from "./audit-Dk69ufby.js";
 import { t as discoverGatewayBeacons } from "./bonjour-discovery-CvdBbgdO.js";
-import { _ as pickGatewaySelfPresence, a as markStorageLifecycleStopping, c as awaitGatewayRecoveryReleased, d as stopGatewayRestartRecoveryForShutdown, f as DOCTOR_AUTHORITY_MISSING, g as verifyRecoveryAuthority, h as rotateRecoveryAuthoritySecret, i as getStorageV1Snapshot, l as initGatewayRecoveryControls, m as mintRecoveryAuthority, o as startSessionStorage, p as doctorInspect, r as getStatusSummary, s as FatalConfiguredStorageStartError, u as startGatewayRestartRecoveryRuntime } from "./status-D_sJaQfK.js";
-import { c as redactOwner, d as redactSensitiveHealthSummary, f as styleHealthChannelLine, n as getHealthSnapshot, t as formatHealthChannelLines } from "./health-K3ylOag4.js";
+import { _ as pickGatewaySelfPresence, a as markStorageLifecycleStopping, c as awaitGatewayRecoveryReleased, d as stopGatewayRestartRecoveryForShutdown, f as DOCTOR_AUTHORITY_MISSING, g as verifyRecoveryAuthority, h as rotateRecoveryAuthoritySecret, i as getStorageV1Snapshot, l as initGatewayRecoveryControls, m as mintRecoveryAuthority, o as startSessionStorage, p as doctorInspect, r as getStatusSummary, s as FatalConfiguredStorageStartError, u as startGatewayRestartRecoveryRuntime } from "./status-B8Al6FzI.js";
+import { c as redactOwner, d as redactSensitiveHealthSummary, f as styleHealthChannelLine, n as getHealthSnapshot, t as formatHealthChannelLines } from "./health-jZPF8weC.js";
 import { r as resolveStaleClaimAdoptionMs } from "./recovery-adapter-DotS3Kpf.js";
-import { a as respondTaskRegistryUnavailable, c as tasksHandlers, d as withTimeout$1, i as resolveTaskOperatorRegistry, l as retryDelayMs, r as getTaskOperatorRegistry, t as DEFAULT_RETENTION_DAYS, u as waitForStopDrain } from "./task-runlog-retention-vP8bhD14.js";
+import { a as respondTaskRegistryUnavailable, c as tasksHandlers, d as withTimeout$1, i as resolveTaskOperatorRegistry, l as retryDelayMs, r as getTaskOperatorRegistry, t as DEFAULT_RETENTION_DAYS, u as waitForStopDrain } from "./task-runlog-retention-CJeUxN8v.js";
 import { a as resolveControlUiRootSync, i as resolveControlUiRootOverrideSync, t as ensureControlUiAssetsBuilt } from "./control-ui-assets-BmGADdd3.js";
 import { h as normalizeUpdateChannel, l as DEFAULT_PACKAGE_CHANNEL, n as checkUpdateStatus, o as resolveNpmChannelTag, r as compareSemverStrings } from "./channel-account-context-Be3GBPZv.js";
 import { t as reconcileBundledInstalls } from "./reconcile-bundled-DA1E5LKR.js";
 import { a as resolveCommandSecretsFromActiveRuntimeSnapshot, i as prepareSecretsRuntimeSnapshot, n as clearSecretsRuntimeSnapshot, r as getActiveSecretsRuntimeSnapshot, t as activateSecretsRuntimeSnapshot } from "./runtime-C-002lmV.js";
 import "./onboarding.secret-input-Dq-s1TkV.js";
-import { t as runOnboardingWizard } from "./onboarding-9F7Zrfos.js";
+import { t as runOnboardingWizard } from "./onboarding-C6Xs7G9Y.js";
 import { a as CONTROL_UI_V2_SERVICE_NAME, i as webBundleMissingMessage, n as buildUserClientRuntimeConfig, o as buildControlUiV2RuntimeConfig, r as resolvePackagedWebBundleRootSync, t as USER_CLIENT_ID } from "./runtime-config-DBO3Spsi.js";
-import { a as sendApnsAlert, c as parseMessageWithAttachments, d as shouldLogWs, f as summarizeAgentEventForWsLog, i as resolveApnsAuthConfigFromEnv, l as formatForLog, n as normalizeApnsEnvironment, o as sendApnsBackgroundWake, p as setGatewayWsLogStyle, s as normalizeRpcAttachmentsToChatAttachments, t as loadApnsRegistration, u as logWs } from "./push-apns-BAZsfMOy.js";
-import { a as readChatHistoryPage, c as REPLY_CONTEXT_CUSTOM_TYPE, d as admitUiActionHead, f as bindUiActionTurn, g as UiSurfaceRefSchema, h as assertValidParams, i as decodeHistoryCursor, l as buildReplyContextPayload, m as unsubscribeSessionChanges, o as resolveDbLeafEntryId, p as reserveUiActionAdmission, r as InvalidHistoryCursorError, s as resolveDbMessageEntryById, t as sessionsHandlers, u as UI_ACTION_CUSTOM_TYPE } from "./sessions-CLXwtR8F.js";
+import { a as sendApnsAlert, c as parseMessageWithAttachments, d as shouldLogWs, f as summarizeAgentEventForWsLog, i as resolveApnsAuthConfigFromEnv, l as formatForLog, n as normalizeApnsEnvironment, o as sendApnsBackgroundWake, p as setGatewayWsLogStyle, s as normalizeRpcAttachmentsToChatAttachments, t as loadApnsRegistration, u as logWs } from "./push-apns--0fj47Qj.js";
+import { a as readChatHistoryPage, c as REPLY_CONTEXT_CUSTOM_TYPE, d as admitUiActionHead, f as bindUiActionTurn, g as UiSurfaceRefSchema, h as assertValidParams, i as decodeHistoryCursor, l as buildReplyContextPayload, m as unsubscribeSessionChanges, o as resolveDbLeafEntryId, p as reserveUiActionAdmission, r as InvalidHistoryCursorError, s as resolveDbMessageEntryById, t as sessionsHandlers, u as UI_ACTION_CUSTOM_TYPE } from "./sessions-CpqHo_Lm.js";
 import { T as resolveGmailHookRuntimeConfig, _ as buildGogWatchServeArgs, i as ensureTailscaleEndpoint, v as buildGogWatchStartArgs } from "./gmail-setup-utils-RfDXQqjM.js";
 import { t as tombstoneAgentSessions } from "./delete-agent-sessions-C3qUH3Pb.js";
-import { n as isNodeCommandAllowed, r as resolveNodeCommandAllowlist } from "./node-command-policy-CVGtgIFJ.js";
+import { n as isNodeCommandAllowed, r as resolveNodeCommandAllowlist } from "./node-command-policy-Dbm2r7IP.js";
 import "./node-service-sgaaUb7H.js";
 import "./status.update-DB9BGZ7P.js";
 import { i as resolveActiveLogFile, n as readLogSlice } from "./log-tail-C_NfLTPZ.js";
 import { i as POSTGRES_BACKUP_REQUIRED_MESSAGE, r as runSessionsMaintenance, s as validateSessionStorageCore } from "./sessions-maintenance-core-CyQOPojH.js";
 import "./session-store-targets-uZ_u9cA2.js";
 import { t as installSkill } from "./skills-install-BvMctkBV.js";
-import { r as runGatewayUpdate } from "./update-runner-BOwq67Zr.js";
+import { r as runGatewayUpdate } from "./update-runner-BMCWrif2.js";
 import { i as shouldIncludeHook, r as resolveHookConfig, t as loadWorkspaceHookEntries } from "./workspace-BbpQhgWx.js";
-import { c as heartbeatProbeRunArtifactId, d as runIsolatedHeartbeatProbe, i as HEARTBEAT_PROBE_REASON, l as isHeartbeatProbeError, o as assertHeartbeatProbeDeliveryIsSafe, p as readValidationActivation, r as HEARTBEAT_PROBE_ALLOWED_TARGET, s as assertHeartbeatProbeParamsAreClosed, t as VALIDATION_ABORT_COMMAND, u as probeSessionKey$1 } from "./operator-commands-QumqWQQg.js";
+import { c as heartbeatProbeRunArtifactId, d as runIsolatedHeartbeatProbe, i as HEARTBEAT_PROBE_REASON, l as isHeartbeatProbeError, o as assertHeartbeatProbeDeliveryIsSafe, p as readValidationActivation, r as HEARTBEAT_PROBE_ALLOWED_TARGET, s as assertHeartbeatProbeParamsAreClosed, t as VALIDATION_ABORT_COMMAND, u as probeSessionKey$1 } from "./operator-commands-DWyDwJ5E.js";
 import { n as forceFreePortAndWait } from "./ports-CNx2NF6s.js";
 import { spawn, spawnSync } from "node:child_process";
 import { cpuUsage, memoryUsage, resourceUsage, uptime } from "node:process";
@@ -9052,6 +9052,7 @@ const BASE_METHODS = [
 	"secrets.reload",
 	"secrets.resolve",
 	"sessions.create",
+	"sessions.direct",
 	"sessions.subscribe",
 	"sessions.list",
 	"sessions.describe",
@@ -16585,7 +16586,7 @@ const nodeHandlers = {
 		const p = params;
 		const payloadJSON = typeof p.payloadJSON === "string" ? p.payloadJSON : p.payload !== void 0 ? JSON.stringify(p.payload) : null;
 		await respondUnavailableOnThrow(respond, async () => {
-			const { handleNodeEvent } = await import("./server-node-events-CqQhTT1T.js");
+			const { handleNodeEvent } = await import("./server-node-events-mxzClNCx.js");
 			const nodeId = client?.connect?.device?.id ?? client?.connect?.client?.id ?? "node";
 			await handleNodeEvent({
 				deps: context.deps,
@@ -17937,6 +17938,7 @@ const STORAGE_METHOD_POLICY_NONE = [
 	"chat.surfaces.get",
 	"chat.surfaces.pin",
 	"sessions.abort",
+	"sessions.direct",
 	"wake",
 	"cron.list",
 	"cron.status",
@@ -24481,10 +24483,11 @@ const ttsHandlers = {
 			});
 			if (!result.success || !result.audioPath) {
 				const rawError = result.error ?? "TTS conversion failed";
-				log$12.warn(`tts.speak: synthesis failed: ${rawError}`);
+				log$12.warn(`tts.speak: synthesis failed: ${redactSensitiveText(rawError)}`);
 				respond(false, void 0, errorShape(ErrorCodes.UNAVAILABLE, stripAbsolutePaths(rawError)));
 				return;
 			}
+			if (result.fallbackErrors?.length) log$12.warn(`tts.speak: served by ${result.provider} after ${result.fallbackErrors.length} failed provider(s) in ${result.latencyMs}ms: ${redactSensitiveText(stripAbsolutePaths(result.fallbackErrors.join("; ")))}`);
 			const mimeType = SPEECH_MIME_BY_EXTENSION[path.extname(result.audioPath).toLowerCase()];
 			if (!mimeType) {
 				respond(false, void 0, errorShape(ErrorCodes.UNAVAILABLE, `unsupported audio format "${path.extname(result.audioPath).toLowerCase()}"`, { details: { reason: "unsupported_audio_format" } }));
@@ -26692,7 +26695,7 @@ function normalizeAgentPayload(payload) {
 async function startBrowserControlServerIfEnabled() {
 	if (isTruthyEnvValue(process.env.OPENCLAW_SKIP_BROWSER_CONTROL_SERVER)) return null;
 	const override = process.env.OPENCLAW_BROWSER_CONTROL_MODULE?.trim();
-	const mod = override ? await import(override) : await import("./server-ks1TmG7W.js");
+	const mod = override ? await import(override) : await import("./server-D7EeBwPd.js");
 	const start = typeof mod.startBrowserControlServiceFromConfig === "function" ? mod.startBrowserControlServiceFromConfig : mod.startBrowserControlServerFromConfig;
 	const stop = typeof mod.stopBrowserControlService === "function" ? mod.stopBrowserControlService : mod.stopBrowserControlServer;
 	if (!start) return null;
@@ -37105,7 +37108,7 @@ async function bootGatewayServer(port, opts, bootStorageTeardown) {
 		const sweepLog = log$1.child("session-consumer-claim-sweep");
 		const { createDiagnosticRingBuffer } = await import("./session-consumer-diagnostics-YTCSpixg.js");
 		const diagnostics = createDiagnosticRingBuffer();
-		const { setDiagnostics } = await import("./sessions-CLXwtR8F.js").then((n) => n.n);
+		const { setDiagnostics } = await import("./sessions-CpqHo_Lm.js").then((n) => n.n);
 		if (sessionConsumerClaimSweepCancelled) return;
 		setDiagnostics(diagnostics);
 		const lastKnownEnabledState = /* @__PURE__ */ new Map();
@@ -37144,7 +37147,7 @@ async function bootGatewayServer(port, opts, bootStorageTeardown) {
 					lastKnownEnabledState,
 					cfg: loadConfig()
 				});
-				const { setLastSweepTimestamp } = await import("./sessions-CLXwtR8F.js").then((n) => n.n);
+				const { setLastSweepTimestamp } = await import("./sessions-CpqHo_Lm.js").then((n) => n.n);
 				setLastSweepTimestamp(Date.now());
 			} catch (err) {
 				sweepLog.warn(`session consumer-claim sweep failed: ${String(err)}`);
@@ -37166,7 +37169,7 @@ async function bootGatewayServer(port, opts, bootStorageTeardown) {
 			prepare: () => {
 				taskPipelineBoot = (async () => {
 					const { getConfiguredSessionStorageRuntime } = await import("./config-CYZVnAj4.js").then((n) => n.Vn);
-					const { startTaskPipeline } = await import("./task-pipeline-boot-BMwRQ8Fe.js");
+					const { startTaskPipeline } = await import("./task-pipeline-boot-C1v58b1_.js");
 					const pipeline = startTaskPipeline({
 						getConfigured: getConfiguredSessionStorageRuntime,
 						cfg: cfgAtStart,
@@ -37969,7 +37972,7 @@ async function stopInteractiveWorkBeforeClose(params) {
 	let acpCancelTimedOut = false;
 	let cancelledRunIds = [];
 	try {
-		const { getAcpSessionManager } = await import("./manager-d_jLZwIa.js").then((n) => n.n);
+		const { getAcpSessionManager } = await import("./manager-gw84UdyQ.js").then((n) => n.n);
 		const result = await getAcpSessionManager().cancelActiveTurnsForShutdown({
 			reason: params.reason,
 			timeoutMs: Math.max(1, params.budgetMs - PENDING_REPLY_RESERVE_MS)
@@ -38148,7 +38151,7 @@ async function runGatewayLoop(params) {
 					if (isRestart) {
 						markGatewayDraining();
 						const activeTasks = getActiveTaskCount();
-						const acpManager = (await import("./manager-d_jLZwIa.js").then((n) => n.n)).getAcpSessionManager();
+						const acpManager = (await import("./manager-gw84UdyQ.js").then((n) => n.n)).getAcpSessionManager();
 						const activeTurns = acpManager.getActiveTurnCount();
 						if (activeTasks > 0 || activeTurns > 0) {
 							gatewayLog$1.info(`draining ${activeTasks} active task(s), ${activeTurns} active acp turn(s) before restart (timeout ${DRAIN_TIMEOUT_MS}ms)`);

package/dist/{gateway-rpc-D36kXOsx.js → gateway-rpc-BArMTxJU.js}

@@ -1,5 +1,5 @@
 import { Ai as GATEWAY_CLIENT_MODES, ji as GATEWAY_CLIENT_NAMES } from "./config-CYZVnAj4.js";
-import { n as callGateway, o as openGatewayCliSession } from "./call-xB0MOQUF.js";
+import { n as callGateway, o as openGatewayCliSession } from "./call-B1surxJJ.js";
 import { n as withProgress } from "./progress-uho16eSS.js";
 
 //#region src/cli/gateway-rpc.ts

package/dist/{gateway-rpc-hfUfa0T-.js → gateway-rpc-k1CUY-d7.js}

@@ -1,5 +1,5 @@
 import { ao as GATEWAY_CLIENT_NAMES, io as GATEWAY_CLIENT_MODES } from "./model-selection-DcDzsVrL.js";
-import { n as callGateway, o as openGatewayCliSession } from "./call-CUY8VoHh.js";
+import { n as callGateway, o as openGatewayCliSession } from "./call-CsmPnXmY.js";
 import { n as withProgress } from "./progress-CSrWZhGt.js";
 
 //#region src/cli/gateway-rpc.ts

package/dist/github-copilot-token-DYYKoDuV.js

@@ -0,0 +1,106 @@
+import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
+import { l as resolveStateDir } from "./paths-BIDPYPVC.js";
+import path from "node:path";
+import fs from "node:fs";
+
+//#region src/infra/json-file.ts
+function loadJsonFile(pathname) {
+	try {
+		if (!fs.existsSync(pathname)) return;
+		const raw = fs.readFileSync(pathname, "utf8");
+		return JSON.parse(raw);
+	} catch {
+		return;
+	}
+}
+function saveJsonFile(pathname, data) {
+	const dir = path.dirname(pathname);
+	if (!fs.existsSync(dir)) fs.mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	fs.writeFileSync(pathname, `${JSON.stringify(data, null, 2)}\n`, "utf8");
+	fs.chmodSync(pathname, 384);
+}
+
+//#endregion
+//#region src/providers/github-copilot-token.ts
+var github_copilot_token_exports = /* @__PURE__ */ __exportAll({
+	DEFAULT_COPILOT_API_BASE_URL: () => DEFAULT_COPILOT_API_BASE_URL,
+	deriveCopilotApiBaseUrlFromToken: () => deriveCopilotApiBaseUrlFromToken,
+	resolveCopilotApiToken: () => resolveCopilotApiToken
+});
+const COPILOT_TOKEN_URL = "https://api.github.com/copilot_internal/v2/token";
+function resolveCopilotTokenCachePath(env = process.env) {
+	return path.join(resolveStateDir(env), "credentials", "github-copilot.token.json");
+}
+function isTokenUsable(cache, now = Date.now()) {
+	return cache.expiresAt - now > 300 * 1e3;
+}
+function parseCopilotTokenResponse(value) {
+	if (!value || typeof value !== "object") throw new Error("Unexpected response from GitHub Copilot token endpoint");
+	const asRecord = value;
+	const token = asRecord.token;
+	const expiresAt = asRecord.expires_at;
+	if (typeof token !== "string" || token.trim().length === 0) throw new Error("Copilot token response missing token");
+	let expiresAtMs;
+	if (typeof expiresAt === "number" && Number.isFinite(expiresAt)) expiresAtMs = expiresAt > 1e10 ? expiresAt : expiresAt * 1e3;
+	else if (typeof expiresAt === "string" && expiresAt.trim().length > 0) {
+		const parsed = Number.parseInt(expiresAt, 10);
+		if (!Number.isFinite(parsed)) throw new Error("Copilot token response has invalid expires_at");
+		expiresAtMs = parsed > 1e10 ? parsed : parsed * 1e3;
+	} else throw new Error("Copilot token response missing expires_at");
+	return {
+		token,
+		expiresAt: expiresAtMs
+	};
+}
+const DEFAULT_COPILOT_API_BASE_URL = "https://api.individual.githubcopilot.com";
+function deriveCopilotApiBaseUrlFromToken(token) {
+	const trimmed = token.trim();
+	if (!trimmed) return null;
+	const proxyEp = trimmed.match(/(?:^|;)\s*proxy-ep=([^;\s]+)/i)?.[1]?.trim();
+	if (!proxyEp) return null;
+	const host = proxyEp.replace(/^https?:\/\//, "").replace(/^proxy\./i, "api.");
+	if (!host) return null;
+	return `https://${host}`;
+}
+async function resolveCopilotApiToken(params) {
+	const env = params.env ?? process.env;
+	const cachePath = params.cachePath?.trim() || resolveCopilotTokenCachePath(env);
+	const loadJsonFileFn = params.loadJsonFileImpl ?? loadJsonFile;
+	const saveJsonFileFn = params.saveJsonFileImpl ?? saveJsonFile;
+	const cached = loadJsonFileFn(cachePath);
+	if (cached && typeof cached.token === "string" && typeof cached.expiresAt === "number") {
+		if (isTokenUsable(cached)) return {
+			token: cached.token,
+			expiresAt: cached.expiresAt,
+			source: `cache:${cachePath}`,
+			baseUrl: deriveCopilotApiBaseUrlFromToken(cached.token) ?? DEFAULT_COPILOT_API_BASE_URL
+		};
+	}
+	const res = await (params.fetchImpl ?? fetch)(COPILOT_TOKEN_URL, {
+		method: "GET",
+		headers: {
+			Accept: "application/json",
+			Authorization: `Bearer ${params.githubToken}`
+		}
+	});
+	if (!res.ok) throw new Error(`Copilot token exchange failed: HTTP ${res.status}`);
+	const json = parseCopilotTokenResponse(await res.json());
+	const payload = {
+		token: json.token,
+		expiresAt: json.expiresAt,
+		updatedAt: Date.now()
+	};
+	saveJsonFileFn(cachePath, payload);
+	return {
+		token: payload.token,
+		expiresAt: payload.expiresAt,
+		source: `fetched:${COPILOT_TOKEN_URL}`,
+		baseUrl: deriveCopilotApiBaseUrlFromToken(payload.token) ?? DEFAULT_COPILOT_API_BASE_URL
+	};
+}
+
+//#endregion
+export { saveJsonFile as a, loadJsonFile as i, github_copilot_token_exports as n, resolveCopilotApiToken as r, DEFAULT_COPILOT_API_BASE_URL as t };

package/dist/{health-CVUuZRpQ.js → health-DjlQU_Tv.js}

@@ -1,16 +1,16 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
 import { F as isRich, I as theme, T as info } from "./utils-RlDPCeiE.js";
-import { D as resolveHeartbeatSummaryForAgent } from "./reply-CqYQeNjd.js";
+import { D as resolveHeartbeatSummaryForAgent } from "./reply-BSMDupOw.js";
 import { d as resolveDefaultAgentId } from "./agent-scope-BKt9T-GX.js";
 import { t as createSubsystemLogger } from "./subsystem-Cwzs7yN0.js";
 import { p as normalizeAgentId } from "./session-key-AbnCDH5g.js";
 import { Ft as loadConfig, Ki as getChannelPlugin, Vi as resolveStorePath, ci as loadSessionStore, da as resolvePreferredAccountId, la as buildChannelAccountBindings, qi as listChannelPlugins, ti as SessionStorageUnavailableError } from "./model-selection-DcDzsVrL.js";
 import { t as isTruthyEnvValue } from "./env-uQrKrEGz.js";
 import { i as formatErrorMessage } from "./errors-DsWFNWeE.js";
-import { r as callGatewayCli, t as buildGatewayConnectionDetails } from "./call-CUY8VoHh.js";
+import { r as callGatewayCli, t as buildGatewayConnectionDetails } from "./call-CsmPnXmY.js";
 import { t as formatDurationCompact } from "./format-duration-CezeS0x4.js";
-import { b as getGatewayRestartRecoveryRuntime } from "./agent-turn-runner-C3Buntbu.js";
-import { r as resolveSessionStorageRoute } from "./session-storage-owner-DLQ3vsAz.js";
+import { b as getGatewayRestartRecoveryRuntime } from "./agent-turn-runner-Btk5sBH0.js";
+import { r as resolveSessionStorageRoute } from "./session-storage-owner-ClZPCWep.js";
 import { n as withProgress } from "./progress-CSrWZhGt.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-BQGm09z6.js";
 

package/dist/{health-K3ylOag4.js → health-jZPF8weC.js}

@@ -5,12 +5,12 @@ import { r as isTruthyEnvValue } from "./entry.js";
 import { Fn as loadSessionStore, Fr as buildChannelAccountBindings, Lr as resolvePreferredAccountId, On as SessionStorageUnavailableError, c as loadConfig, pr as resolveStorePath, vr as getChannelPlugin, yr as listChannelPlugins } from "./config-CYZVnAj4.js";
 import { p as normalizeAgentId } from "./session-key-CwCMr1YE.js";
 import { d as resolveDefaultAgentId } from "./agent-scope-CGUJ4BsZ.js";
-import { i as resolveHeartbeatSummaryForAgent } from "./agent-turn-execute-3cc3W1hp.js";
-import { b as getGatewayRestartRecoveryRuntime } from "./agent-turn-runner-DUKUxZcn.js";
+import { i as resolveHeartbeatSummaryForAgent } from "./agent-turn-execute-CFwfJKy2.js";
+import { b as getGatewayRestartRecoveryRuntime } from "./agent-turn-runner-12Exv9CB.js";
 import { i as formatErrorMessage } from "./errors-WJSmX0uj.js";
-import { r as callGatewayCli, t as buildGatewayConnectionDetails } from "./call-xB0MOQUF.js";
+import { r as callGatewayCli, t as buildGatewayConnectionDetails } from "./call-B1surxJJ.js";
 import { t as formatDurationCompact } from "./format-duration-DeLiQNNv.js";
-import { r as resolveSessionStorageRoute } from "./session-storage-owner-1-cQlOCZ.js";
+import { r as resolveSessionStorageRoute } from "./session-storage-owner-M7vbUIWw.js";
 import { n as withProgress } from "./progress-uho16eSS.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-fSLI0qW-.js";